---
id: "CVE-2020-1027"
kind: "vulnerability"
aliases: ["CVE-2020-1027"]
title: "Microsoft Windows: Microsoft Windows Kernel Privilege Escalation Vulnerability"
severity: "high"
cvss: 7.8
epss: 0.04723
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft Windows", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "self-hosted", "windows"]
not_affected_if: ["patched-windows"]
published_at: "2020-04-15T15:15:21+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-1027", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-1027", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1027", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Microsoft Windows: Microsoft Windows Kernel Privilege Escalation Vulnerability

A flaw in how the Windows kernel handles objects in memory lets a local user raise their privileges. An attacker who already has code running on the machine can gain elevated (SYSTEM-level) control.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Windows affected ? fixed ?

## Fix

Apply the Microsoft Windows security update for CVE-2020-1027 per vendor instructions (CISA KEV required action).

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-1027
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-1027
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-1027

## From the sources

An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_